Authentication
Authenticate your requests to the ZexRail API
API Key Authentication
Use bearer tokens to authenticate API requests
All API requests must include your API key in the Authorization header as a Bearer token.
curl -X GET "https://api.zexrail.com/v1/agents" \
-H "Authorization: Bearer sk_test_xxxxxxxxxxxxxxxx"Header Format
Authorization: Bearer <your_api_key>Environment Separation
Sandbox and production environments are completely isolated
warning
Test Environment
- • API prefix:
sk_test_ - • Base URL:
api.sandbox.zexrail.com - • No real money movement
- • Test agents and settlements
success
Live Environment
- • API prefix:
sk_live_ - • Base URL:
api.zexrail.com - • Real settlements executed
- • Audit logging enabled
Never use production keys in development
Always use sandbox keys during development and testing. Production keys should only be used in secure production environments.
Environment Variables
Store your credentials securely
# .env.local
ZEXRAIL_API_KEY=sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ZEXRAIL_WEBHOOK_SECRET=whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxSDK Authentication
Using the ZexRail SDK handles authentication automatically
import { ZexRailClient } from '@zexrail/sdk';
// Initialize with API key
const client = new ZexRailClient({
apiKey: process.env.ZEXRAIL_API_KEY,
environment: 'sandbox', // or 'production'
});
// Client automatically includes auth headers
const agents = await client.agents.list();Key Management
Managing your API keys
Sandbox API Key
sk_test_••••••••••••••••••••••••success
Production API Key
Not yet configured. Enable production access in settings.
Key rotation best practices:
- • Rotate keys every 90 days
- • Use separate keys for different services
- • Monitor key usage in the dashboard
- • Revoke unused keys immediately